rage.fail

azure-appsvc-list-function-keys

derived azure emits CanReadSecret

match (effective permission)

{ "action": [ "Microsoft.Web/sites/host/listkeys/action", "Microsoft.Web/sites/functions/listkeys/action", "Microsoft.Web/sites/functions/listsecrets/action", "Microsoft.Web/sites/functions/masterkey/read" ], "scope_type": "resource|resourceGroup|subscription" }

where

site is a Function App

emit

source	`<principal>`
target	`<function/host/master key of the Function App>`
permissions	`Microsoft.Web/sites/host/listkeys/action` `Microsoft.Web/sites/functions/listkeys/action` `Microsoft.Web/sites/functions/masterkey/read`

Narrative

{principal.name} can list function/host keys of {target.name} (listkeys), enabling direct invocation of its functions.

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-list-function-keys
emits: CanReadSecret
match_effective_permission:
  action:
  - Microsoft.Web/sites/host/listkeys/action
  - Microsoft.Web/sites/functions/listkeys/action
  - Microsoft.Web/sites/functions/listsecrets/action
  - Microsoft.Web/sites/functions/masterkey/read
  scope_type: resource|resourceGroup|subscription
where:
- site is a Function App
emit:
  source: <principal>
  target: <function/host/master key of the Function App>
  permissions:
  - Microsoft.Web/sites/host/listkeys/action
  - Microsoft.Web/sites/functions/listkeys/action
  - Microsoft.Web/sites/functions/masterkey/read
  note: Returns function/host/master keys used to invoke (and, with the master/admin key, manage) HTTP
    functions. Feeds azure-appsvc-invoke-function.
  false_positive_note: A function key enables INVOKING the function, not an ARM credential. Execute-as
    only follows if the Function App has a managed identity.
  narrative: '{principal.name} can list function/host keys of {target.name} (listkeys), enabling direct
    invocation of its functions.'